1. Field of the Invention
The present application concerns the field of receivers/decoders of conditional access services, particularly of receivers that have a storage unit such as hard disks.
2. Background
The technological evolution in the field of storage capacities and the speed of the magnetic disks (hard disks) has made it possible to store the content of a transmitted video to make it accessible off-line to a user.
Such recorders are known by the brand names ReplayTV® or Tivo® and offer storages of several tens of hours of digital transmission. These recorders, however, not directly integrated in the receivers/decoders of conditional access services; particularly, the content is stored without specific protection on the disk, which makes it impossible to collect the authors' royalties associated with the content in the case where the disk would then be duplicated with commercial redistribution ends.
Conversely, in a digital pay television system, the digital stream transmitted to these receivers is encrypted in order to be able to control the use and to define the conditions for such a use. This encryption is carried out with control words that are changed at a regular interval (typically between 5 and 30 seconds) so as to dissuade attacks trying to recover such a control word.
According to a particular embodiment, the control words are changed at much longer intervals, which means that for a given event, it is encrypted by one single control word.
For the receiver to be able to decrypt the stream encrypted by these control words, the latter are sent to it independently of the stream in control messages (ECM) encrypted by a key specific to the transmission system between the operating system (CAS) and the security module of the user unit. In fact, the security operations are performed in a security unit (SC) that is generally in the form of a smart card, said to be inviolable. This unit can either be of a removable type or may be directly integrated in the receiver.
During the decryption of a control message (ECM), the presence of the right to access the considered flux is verified in the security unit (SC). This right can be administered by authorization messages (EMM) that control such a right in the security unit (SC). Other possibilities are equally possible, such as the sending of decryption keys.
In this description, we will use the name “event’ for a content of video, audio (for example MP3) or data (a game program for example) that is encrypted according to the known method of control words, each event being able to be encrypted by one or several control words, each having a determined duration of validity.
The accounting of use of such events is based today on the principle of subscription, of the purchase of events, or of the payment per time unit.
The subscription allows to define a right associated to one or several transmission channels of these events and allows the user to obtain these events in decrypted form if the right is present in its security unit.
At the same time, it is possible to define rights that are specific to an event, such as a film or a football match. The user can acquire this right (by purchase for example) and this event will be specifically administered by this right. This method is known as pay-per-view (PPV).
As for the payment per time unit, the security unit comprises a credit that is debited depending on the real consumption of the user. In this way, for example, a unit's credit will be debited every minute the channel basis of the or event selected. It is possible according to the technical implementations to vary the accounting unit, either in the duration or in the value of the assigned time, even combining these two parameters to adapt the invoicing to the type of transmitted event.
A control message (ECM) contains not only the control word, but also the conditions for this control word to be present in the receiver/decoder. During the decryption of the control words, the presence in the security unit of a right, or entitlement, associated with the announced conditions of access in the message will be verified.
The control word is returned to the user unit only when the comparison is positive. This control word is contained in a control message ECM that is encrypted by a transmission key TK.
For the right to be present in the security unit, it is generally charged unit by a right management message (EMM), which for security reasons is generally encrypted by a different key referred to as right a key (RK).
According to a known form of pay television transmission, the following three elements are necessary for decrypting an event at a given moment:                the event encrypted by one or several control words (CW),        the control message or messages ECM containing the control words (CW) and the access conditions (AC),        the corresponding right stored in the security unit allowing to verify said access conditions.        
According to a known design, the encrypted event that is stored in a storage unit such as a hard disk is accompanied at least by one or several control messages ECM.
Due to the fact that the decryption a posteriori of the ECM messages can be a problem, particularly because of the changing of the transmission key, a first solution is proposed in the document EP 0 912 052, which solution implies decryption of these messages in the security unit and re-encryption before the storage on the disk.
This solution solves the problem of the working life of the transmission key, but places a large processing burden on the security unit at the moment of the recording, without knowing if the recorded content will one day be used. Furthermore, one of the fundamental rules of the security system is to return the control words to the user unit only if the rights exist. In this case, it is very probable that these rights do not exist if we consider a pay-per-view event. The right will be acquired during a purchase that can be done much later, when the user decides to view this event.
This document EP 0 912 052 does not solve the problem of access to the right as at the moment of the purchase, the right message EMM has to be always transmitted so that it is charged in the security unit.
In this way, the solution described in this document is only applicable for transmitted events for which the right is already present in the security unit in order to authorize the decryption and the re-encryption of the ECM.
Another aspect is the conservation of the rights of a holder. Let us take for example when a holder A has reception rights of the channels M, N, P. He/she then has the right to view these channels and thus to record and view at will the events that are in his/her storage unit. With each use of such an event, the security unit will be required to decrypt the messages ECM and to return the control words. It is then important that the rights linked to this event are present in the security unit.
In the case of an event obtained by a subscription, the identification of this event is associated to the subscription channel, for example M. Thus all the events that bear the identifier M are authorized and the control words are returned to the decoder.
These rights are then associated to a particular channel defined by an identifier such as M. When the subscriber cancels his/her subscription, or modifies it for other channels, it results that the events recorded in the storage unit will be inaccessible because the security unit will refuse to resend the control words, the corresponding right no longer being present.
This situation can also take place if a new identifier is attributed to the channel M. It is thus possible that the reorganization of the channels attributes to this channel the identifier J4 instead of M. From the point of view of the transmission rights, the security unit is timely informed of the change and the user records no disagreement.
The consequences for a recorded event are more dramatic. This re-assignment will result in the recorded event being inaccessible, because the corresponding right is no longer present in the security unit.